@pwnlambda

aspiring iOS researcher & estradiol enthusiast @ @calif_io

Joined September 2014
  • Tweets19
  • Following1K
  • Followers1.6K
lambda retweeted
Calif
@calif_io10h
CC @pwnlambda
112
351
134
3,892
835,048
I get the best results when I pretend I’m a TV lawyer. I poke around the code by asking detailed questions to prime the context with model generated facts. These are used for the contract invalidation question “is it ever possible that …” In my head I call it the Matlock method
Brendan Dolan-Gavitt
@moyixOct 22
The weird part about this is that it can be hard to pin down exactly what makes the difference. An expert just chatting with a frontier model will still get better results than someone unfamiliar with the topic!
2
5
27
2,156
ICYMI: sockpuppet.org/blog/2026/03/…

Vulnerability Research Is Cooked

Vulnerability discovery has always been gated by elite attention. Elite attention is now abundant. What happens next?

sockpuppet.org
3
19
5
232
47,142
lambda retweeted
itszn@itszn13Oct 21
Largest credit goes to @lcfr_hax for the earliest recent discovery of the bug class. This underlying engine issue was so wide it invited a lot of parallel discovery. As we coordinated our findings the scope of the problem continued to expand!
5
14
3
204
16,178
lambda retweeted
Calif
@calif_ioOct 21
Let’s set the record straight: @lcfr_hax was the first to discover php2shell and develop a working exploit. See his August 5 tweet: xitter.cf/lcfr_hax/status/208503… His work convinced the PHP Foundation to invest in fixing this entire bug class. He then worked around the clock to review, test, and retest the patches.
LCFR
@lcfr_haxAug 5
d935be023a55b04681eccd1d2b8385b4b295e141a5df108e5e979d8d5d7124ac
54
404
92
3,072
385,736
lambda retweeted
LCFR
@lcfr_haxOct 21
Calif
@calif_ioOct 21
php2shell - A tale of two PHP remote vulnerabilities: calif.io/php2shell
88
174
30
1,752
122,145
lambda retweeted
Stefan Esser@i0n1cOct 19
Using an iPhone 18 Pro 27.0 kernel coredump to learn something about sandboxes
6
32
284
20,499
You can see an iPhone get popped and still understand there’s nuance. I think Apple devices are some of the most expensive to attack. Exploiting them doesn’t make other devices more secure. AI is changing the economics but they’re still there. It hasn’t erased the mitigations.
1
10
56
3,269
If you are tired of AI generated analysis of the 0-click CoreGraphics bug fixed in iOS 26.7.1 a few days ago, here is a more authoritative version from our research team. It includes analysis of WhatsApp too so you get 2 for the price of 1. To whoever found this bug: very cool. Please talk to us at @hexacon_fr next month. No PDFs plz.
Calif
@calif_ioSep 30
CVE-2026-86950: The Great Glyph Grift calif.io/research/the-great-…
2
18
161
15,786
lambda retweeted
0x41con@0x41conApr 26
0x41con 7 Mad props to Anna and @qwertyoruiopz for hosting and organising this edition! Kudos to all the speakers! And thank you all for being part of it!
17
5
59
25,702
My kinda hot take on the Mythos stuff is really that there is so little money in offensive research that it's still not really that hard to find bugs. These AI companies are operating with budgets that make the entire offensive research of all big tech combined look like a joke
14
67
3
484
42,014
lambda retweeted
0x41con@0x41con2 May 2025
0x41con 2025 is over!
1
10
15
69
51,909
1
24
9
132
84,876
We are sincerely thankful to our sponsor that make it possible for the mHACKeroni team to take part in the DEF CON 27 CTF in Las Vegas: mhackeroni.it/sponsors/

Sponsors

Italian CTF team. DEF CON finalists. Cyber. Pasta. Hack-A-Sat 4 Winners.

mhackeroni.it
36
82
Load more